PSA: Make Sure to Update Soon, macOS Ventura 13.2.1 and iOS 16.3.1 Address Actively Exploited Vulnerability

[MacRumors]

The macOS Ventura 13.2.1, iPadOS 16.3.1, and iOS 16.3.1 updates that Apple released today include minor bug fixes and address security vulnerabilities, and because one of the vulnerabilities was known to be exploited in the wild, it's important to update to the new software as soon as you can.

According to Apple's security notes for the updates, The software fixes a WebKit issue that could allow maliciously crafted web content to result in arbitrary code execution. Apple says that it is "aware of a report that this issue may have been actively exploited."

The vulnerability was a type confusion issue that Apple says has been addressed with improved checks.

While there are no other notable fixes in macOS Ventura 13.2.1, the iOS 16.3.1 update adds a Siri Find My fix, addresses a problem with iCloud settings, and introduces additional Crash Detection optimizations for iPhone 14 models.

Article Link: PSA: Make Sure to Update Soon, macOS Ventura 13.2.1 and iOS 16.3.1 Address Actively Exploited Vulnerability

 

[RalfTheDog]

Updating as soon as I finish posting this. Not visiting any shady marmot porn websites until I do.

 

[jent]

What about prior OS versions?

 

[klm9210]

Patches, I’m depending on you son…

Done & done!

 

[tywebb13]

There is also a Safari update 16.3 for Big Sur and Monterey to fix it on those systems too.

http://swcdn.apple.com/content/downloads/30/47/032-38743-A_CT6YB7IU0E/etlliehrvoqmlrb8mso9d2lh8vtnb59e0o/Safari16.3BigSurAuto.pkg

(build 16614.4.6.11.6)

https://swcdn.apple.com/content/downloads/61/07/032-38754-A_I6L5FGHO4W/6vezgtgkabm4112wd26y1moii3kak18ykb/Safari16.3MontereyAuto.pkg

(build 17614.4.6.11.6)

Note on how to find build numbers without actually installing it:

1. Copy the url and change the last letter from g to m and download the pkm file instead of the pkg file.

2. Open the pkm file with textedit and scroll down to the line that looks like this (I am using the monterey one as an example)

<bundle CFBundleVersion="17614.4.6.11.6" CFBundleShortVersionString="17614" SourceVersion="7614004006011006" id="com.apple.JavaScriptCore" path="./Library/Apple/System/Library/

This means the build number is 17614.4.6.11.6

Note about the version number:

There is some confusion as to the version number of Safari for Big Sur and Monterey. Currently it installs as Version 16.3, but security info suggests it should be 16.3.1: https://support.apple.com/en-us/HT213638 and https://support.apple.com/en-au/HT201222 . So long as the build numbers are 16614.4.6.11.6 for Big Sur or 17614.4.6.11.6 for Monterey, it is up-to-date regardless of Version numbers. Apple may re-release them with version number 16.3.1 but I would suggest it would be easier to re-edit the security info and just change that back to 16.3 instead - and maybe be more specific about the build numbers.

 

[redbeard331]

I wonder if this can lead to a jailbreak?

But then being stuck in 16.3 forever doesn’t sound fun.

 

[ElectricPotato]

Maybe it will work with Pioneer optical drives again. Or maybe not.

Edit: It does! Yay.

 

[v0lume4]

Nope! I'm staying on iOS 15.7 with my stability and good battery life. YOU'LL NEVER TAKE ME ALIVE!

 

[one more]

Were not important security updates meant to be installed automatically by the OS now, without any user intervention?

 

[Realityck]

While there are no other notable fixes in macOS Ventura 13.2.1

Safari was minor increment change, Darwin Kernel was more recent Jan 30th compared to Jan 5th.

 

[erikkfi]

I assume they’re releasing this fix for Monterey and Big Sur, right? Right??

 

[tywebb13]

I assume they’re releasing this fix for Monterey and Big Sur, right? Right??

Right back in post #5: https://forums.macrumors.com/thread...exploited-vulnerability.2380664/post-31963077

Right?

 

[coolfactor]

I thought they have Hot Fixes that install automatically now?

 

[felixen]

What about prior OS versions?

I’m curious about this, too. I’m still on the MacOS from 2 years ago

 

[maryland]

The Safari update I got for Monterey was mislabeled as 16.3. Safari was already on that version. After updating it still shows as Safari 16.3.

It’s supposed to be Safari 16.3.1:

About the security content of Safari 16.3 - Apple Support

This document describes the security content of Safari 16.3.

support.apple.com

 

[raythompsontn]

There is also an update for the Apple Watch.

 

[PsykX]

I can't even update from macOS 13 to 13.1 or 13.2 on my external drive 😅
I've tried numerous ways (software update, full re-install, from recovery drive), at different times, with different versions (13.1 and 13.2).

Aaaaaaand I ended up throwing up the towel.

 

[raziel101]

I wonder if they will patch Catalina.

 

[aPple nErd]

I wonder if this can lead to a jailbreak?

But then being stuck in 16.3 forever doesn’t sound fun.

Any of these bugs probably also exist on 16.1.2 which is what the JB community is currently trying to stay on.

 

[pinkkie]

I have no problem on my macOS 10.13 High Sierra

 

[tywebb13]

The Safari update I got for Monterey was mislabeled as 16.3. Safari was already on that version. After updating it still shows as Safari 16.3.

It’s supposed to be Safari 16.3.1:

About the security content of Safari 16.3 - Apple Support

This document describes the security content of Safari 16.3.

support.apple.com

So long as your build number is 17614.4.6.11.6 then it is up to date. Don't worry about the version number. They got it wrong, either in the security info or the update itself.

Version numbers can be checked in the pkm file too (although this is more obvious from the link itself)

So if you download the pkm file https://swcdn.apple.com/content/dow...d26y1moii3kak18ykb/Safari16.3MontereyAuto.pkm open with textedit and scroll down to the line

<bundle CFBundleVersion="17614.4.6.11.6" CFBundleShortVersionString="16.3" SourceVersion="7614004006011006" id="com.apple.Safari" path="./Applications/Safari.app"/>

then the version number is 16.3.

 

[klasma]

Updating as soon as I finish posting this. Not visiting any shady marmot porn websites until I do.

Anyone else here because of googling for shady marmot porn?

 

[JonathanParker]

What happened to rapid security responses? 🤔🤔

 

[Carrotcruncher]

Updating as soon as I finish posting this. Not visiting any shady marmot porn websites until I do.

Spankbang working as intended 🤣🤣🤣after update 😂😂😂

 

[cpnotebook80]

Have to update all devices and this afternoon feels like Oprah.